The 10 HIPAA Policies Every Solo Therapist Is Required to Have

If you run a solo therapy practice, HIPAA applies to you the same way it applies to a hospital system. The HIPAA Security Rule's documentation requirement (45 CFR § 164.316) says every covered entity must "implement reasonable and appropriate policies and procedures," keep them in writing, retain them for six years, and update them when your practice or the rules change.

"Reasonable and appropriate" scales with your size — a solo practice's access management policy can be two pages, not forty. But the list of topics you must cover does not shrink just because you're a practice of one.

The checklist

Here are the ten policy domains the Office for Civil Rights (OCR) most consistently requests in audits and breach investigations:

1. Designated Privacy and Security Officials. Yes, even solo — you designate yourself, in writing. This is the single most commonly missed requirement, and it's the first document OCR asks for.
2. Risk Analysis and Risk Management. Your policy for how and when you assess risks to electronic PHI. (The policy is required even though the risk analysis itself is a separate exercise.)
3. Workforce Sanctions. What happens when someone — including a contractor or intern — violates your privacy practices. Solo practices still need this for the day they hire a billing contractor.
4. Access Management. Who can access PHI, how access is granted, and how it's revoked. For a solo practice this is mostly about your own accounts, your EHR settings, and anyone who ever helps you.
5. Audit Controls and Activity Review. How you review access logs — your EHR's login history counts, but you need to say you review it and how often.
6. Contingency Plan. Backup, disaster recovery, and how you'd operate if your laptop died or your EHR went down. OCR asks for this after every ransomware event.
7. Breach Notification. The clock starts when you discover a breach. Your policy needs the 60-day individual notice rule, the HHS reporting thresholds, and your state's notification law.
8. Business Associate Agreements. A list of your vendors that touch PHI (EHR, telehealth platform, billing service, cloud storage) and your process for getting BAAs signed before PHI flows.
9. Workforce Training. When and how anyone who works with you gets HIPAA training, and how you document it — including yourself.
10. Device, Media, and Mobile Security. Encryption, screen locks, what happens to old laptops and phones, and whether client data ever lives on personal devices.

If you treat substance use disorder and receive federal support in ways that trigger 42 CFR Part 2, you need an additional confidentiality overlay — Part 2's consent and redisclosure rules are stricter than HIPAA's.

What "having" a policy actually means

Possessing a folder of templates is not compliance. OCR's requests in practice look like:

• "Provide your policy on X, with its effective date."
• "Provide evidence the policy was in effect at the time of the incident."
• "Provide your six-year revision history for this policy."

That's why adoption matters: a policy needs your name on it, an effective date, and a record of when it changed. A signed, dated, version-controlled policy set is what turns a template into evidence.

The realistic path for a solo practice

You have three honest options:

• Write them yourself from HHS guidance. Free, but plan on 20–40 hours, and you own keeping them current.
• Hire a healthcare attorney to draft them. The gold standard, typically $1,500–5,000, and worth it if you have unusual complexity.
• Use a policy engine that tailors the required set to your practice and keeps them versioned — then have an attorney review the output if you want the extra assurance. This is the middle path we built for.

Whichever you choose: designate your officials in writing this week. It's the one-page policy that's missing from most solo practices, and it takes ten minutes.